AWS Backup is a fully managed backup service that makes it easy to centralize and automate data protection across AWS services. Setting up AWS Backup with Terraform provides a comprehensive guide to configuring AWS Backup for centralized data protection using Terraform Infrastructure as Code. The combination gives teams repeatable, version-controlled backup infrastructure that can be deployed across multiple accounts and regions without clicking through the console.
Backing up AWS resources isn't optional. AWS Backup gives a centralized way to automate and manage backups across services like EC2, RDS, EFS, DynamoDB, and more. When you combine it with Terraform, you get repeatable, version-controlled backup infrastructure that you can deploy across multiple accounts and regions without clicking through the console.
In this post, we'll walk through setting up a complete AWS Backup plan with Terraform, covering vaults, plans, rules, selections, and lifecycle policies.
Why Terraform for AWS Backup
Manual backup configuration through the console is fine for a single account with a handful of resources. But once you're managing multiple environments or accounts, things get messy fast. Terraform lets you define backup policies as code that lives in your repo, apply consistent backup schedules across all environments, track changes to backup configurations through version control, roll back backup policy changes if something goes wrong, and replicate backup strategies across AWS accounts.
You define the AWS Backup plan, vault, and selection inside Terraform modules. Apply them with the same workflow you use for EC2 or S3 resources. Terraform translates these declarations into AWS Backup configurations that automatically enforce recovery points and tag compliance. This ensures backups match the desired state instead of yesterday's guesswork.
A clean AWS Backup Terraform setup starts with identity. Use AWS IAM roles with least privilege access, map them to your Terraform state backend, and make backup policies resources that are as code-driven as your networks or compute stacks. The magic lies in describing retention rules, schedules, and vaults as Terraform resources rather than manual AWS Console inputs. Every update becomes part of your audit trail. Every restore request follows predefined logic instead of improvisation.
How do I integrate AWS Backup with Terraform? You define the AWS Backup plan, vault, and selection inside Terraform modules. Apply them with the same workflow you use for EC2 or S3 resources.
Core AWS Backup Concepts in Terraform
AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services such as Amazon EBS volumes, Amazon EC2 instances, Amazon RDS databases, Amazon DynamoDB tables, Amazon EFS file systems, and AWS Storage Gateway volumes.
A backup vault is where your recovery points are stored. The vault is the storage container for backups and is the first Terraform resource to define.
A backup plan defines the schedule and retention for backups. Plans contain rules that specify when backups run and where they are stored.
A backup selection defines which resources are included in a plan. Selection typically uses tags or resource ARNs to scope coverage.
A lifecycle policy controls retention and transition of recovery points.
The Terraform module to provision AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services.
Note on syntax changes. The syntax of declaring a backup schedule has changed as of release 0.14.0, follow the instructions in the 0.13.x to 0.14.x+ migration guide.
Warning on deprecation. The deprecated variables have been fully deprecated as of 1.x.x.
Prerequisites and Project Structure
Prerequisites for a basic setup include:
- AWS CLI configured
- Terraform installed
- Understanding of backup requirements
- Basic knowledge of AWS services
Project Structure for a typical repository is:
aws-backup-terraform/
├── main.tf
├── variables.tf
├── outputs.tf
└── terraform.tfvars
This structure separates provider configuration, resources, inputs, and outputs for reuse.
For centralized backup across AWS Organizations, additional prerequisites apply:
- AWS Organizations enabled and access to the Management account
- AWS Backup features enabled for your organization
- An AWS account that will be used as your Central Backup account. This account should be registered as a delegated administrator for AWS Organizations
- Terraform v1.3.6 or later installed
To manage the Terraform state, Amazon S3 is used to store our .tfstate file and a Amazon DynamoDB table to maintain the lock state of our environment. Create these resources and update the backend.tf file with the appropriate values. You can learn more about protecting sensitive data in the Terraform state file using the AWS Prescriptive Guidance.
If you plan to use the OrganizationAccountAccessRole for cross-account operations, then you do not need to create any additional roles for managing these resources. However, you will need to update the trust relationships with the Principal of the IAM role or user you will be using to run the Terraform commands from the Management account.
As a best practice, you will want to create roles specifically for Terraform to assume in each account following least privilege.
Basic AWS Backup Configuration
The basic AWS Backup Configuration starts with the provider.
hcl
provider "aws" {
region = var.aws_region
}
AWS Backup Vault resource:
hcl
resource "aws_backup_vault" "main" {
name = "${var.project_name}-vault"
kms_key_arn = aws_kms_key.backup.arn
tags = {
Environment = var.environment
}
}
KMS Key for Encryption:
hcl
resource "aws_kms_key" "backup" {
description = "KMS key for AWS Backup encryption"
deletion_window_in_days = 7
enable_key_rotation = true
tags = {
Environment = var.environment
}
}
IAM Role for AWS Backup:
hcl
resource "aws_iam_role" "backup" {
name = "${var.project_name}-backup-role"
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "backup.amazonaws.com"
}
}
]
})
}
IAM Policy attachment:
hcl
resource "aws_iam_role_policy_attachment" "backup" {
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup"
role = aws_iam_role.backup.name
}
Backup Plan:
hcl
resource "aws_backup_plan" "main" {
name = "${var.project_name}-backup-plan"
rule {
rule_name = "daily-backup"
target_vault_name = aws_backup_vault.main.name
schedule = "cron(0 5"
The schedule uses a cron expression. The rule references the vault created earlier.
Centralized Backup with AWS Organizations
This solution demonstrates how you can save time using Terraform to automate the deployment of your AWS Backup resources across accounts in your organization. Using this solution, you can centrally manage the deployment of AWS Backup resources, such as vaults, as well as backup policies, for all of your AWS Organizations accounts.
Centralized management ensures consistent vault naming, encryption, and retention across accounts. Terraform is used to automate deployment of AWS Backup resources across accounts in your organization.
Key components for centralized setup:
- Central Backup account registered as delegated administrator for AWS Organizations
- Terraform state stored in Amazon S3 with DynamoDB locking
- IAM roles for Terraform to assume in each member account following least privilege
- Backup vaults and plans deployed to each account via Terraform
This approach avoids manual console configuration per account and provides auditability through version control.
Operational Considerations
You open the cloud dashboard on Monday morning and realize half your test environments have vanished overnight. Someone's backup policy expired, and Terraform drifted out of sync. Nothing too catastrophic, but now every recovery step feels like rolling dice in traffic. This is exactly the moment when AWS Backup and Terraform should be saving you, not haunting your ticket queue.
AWS Backup provides centralized, policy-driven backups for EC2, RDS, DynamoDB, EFS, and more. Terraform, on the other hand, treats infrastructure as reproducible code. Combined, they give you full control of both backup creation and lifecycle automation, managed through versioned configuration instead of frantic clicks. But most teams wire them together lazily, which leaves giant cracks in permission boundaries and compliance logs.
A clean setup requires:
- Identity defined with AWS IAM roles with least privilege access
- Terraform state backend mapped and protected
- Backup policies as code-driven resources
- Retention rules, schedules, and vaults described as Terraform resources
- Updates part of the audit trail
- Restore requests following predefined logic instead of improvisation
Common Terraform Resources Table
| Resource | Purpose |
|---|---|
| awsbackupvault | Storage container for recovery points |
| awskmskey | Encryption key for vault |
| awsiamrole | Role assumed by AWS Backup service |
| awsiamrolepolicyattachment | Attach AWS managed service role policy |
| awsbackupplan | Defines backup schedule and retention |
Project Files Table
| File | Contains |
|---|---|
| main.tf | Provider and core AWS Backup resources |
| variables.tf | Input variables for project name, environment, region |
| outputs.tf | Outputs for vault name, plan ARN |
| terraform.tfvars | Values for variables |
Conclusion
Conclusion
AWS Backup with Terraform moves backup configuration from manual console clicks to repeatable, auditable infrastructure as code. AWS Backup provides centralized automation for EC2, RDS, DynamoDB, EFS, and other services, while Terraform ensures those policies are version-controlled, consistent across environments, and recoverable through code history.
Setting up a backup vault as the storage foundation, securing it with KMS encryption, creating a least-privilege IAM role for AWS Backup, and defining a backup plan with a cron schedule forms the core pattern. Project structure with main.tf, variables.tf, outputs.tf, and terraform.tfvars keeps the configuration maintainable.
For organizations, Terraform automates deployment of vaults and backup policies across AWS Organizations accounts from a central backup account. Prerequisites include AWS Organizations enabled, AWS Backup features enabled, a central backup account registered as delegated administrator, and Terraform v1.3.6 or later installed. State management uses Amazon S3 for .tfstate storage and Amazon DynamoDB for locking.
Syntax changes matter. The syntax of declaring a backup schedule has changed as of release 0.14.0, and deprecated variables have been fully deprecated as of 1.x.x. Following migration guidance avoids drift.
When configured cleanly with identity first, least privilege roles, and code-driven retention rules, schedules, and vaults, AWS Backup and Terraform provide full control of backup creation and lifecycle automation with every update in the audit trail and every restore request following predefined logic.